Ethernet Network Tap Bypass Switch Centralized NetFlow And IPFIX​ With Optical Protection Link

Network TAP Bypass Switch Centralized NetFlow and IPFIX​ with Single Mode Optical Protection Link

1. Overviews

With the rapid development of the Internet, the threat of network information security is becoming more and more serious, so a variety of information security protection applications are used more and more widely. Whether it is traditional access control equipment (firewall) or a new type of more advanced protection means such as intrusion prevention system (IPS),Unified threat management platform (UTM), Anti-denial service attack system (Anti-DDoS), Anti-spam Gateway, Unified DPI Traffic Identification and Control System, and many security devices are deployed in series in the network key nodes, the implementation of the corresponding data security policy to identify and deal with legal / illegal traffic. At the same time, however, the computer network will generate a large network delay or even network disruption in the case of fail over, maintenance, upgrade, equipment replacement and so on in a highly reliable production network application environment, users cannot stand it.

NetTAP® bypass switch manual is researched and developed by Chengdu Shuwei Communication Technology Co., Ltd, which can be used for flexible deployment of various types of serial security equipment while providing high network reliability.

By deploying NetTAP® Smart Bypass Protector:

- Users can flexibly install/uninstall security equipment and will not affect the current network and interrupt;

- NetTAP® bypass switch manual with intelligent health detection function to real-time monitoring of the normal working state of the serial security device, once the serial security device work exception, the protection will automatically bypass to maintain the normal network communication;
- Selective traffic protection technology can be used to deploy specific traffic cleaning security equipment, encryption technology based on the audit equipment. Effectively carry out the serial access protection for the specific traffic type, unloading the flow handling pressure of the series device;

- Load Balanced Traffic Protection technology can be used for clustered deployment of secure serial devices to meet the need for serial security in high-bandwidth environments.

2. Intelligent Bypass Swtich Application Solution​

“Specflow” Policy Flow Traction Series Protection

As shown above, when the security network device only needs to deal with the specific traffic in series security protection, through the NetTAP® "bypass switch" traffic per-processing function, through the traffic screening strategy to connect the security device " Concerned "traffic is sent back directly to the network link, and the" concerned traffic section "is traction to the in-line safety device to perform safety checks. This will not only maintain the normal application of the safety detection function of the safety device, but also reduce the inefficient flow of the safety equipment to deal with the pressure; at the same time, the "policy flow traction protector" can detect the working condition of the safety device in real time. The safety device works abnormally bypasses the data traffic directly to avoid disruption of network service.

The NetTAP® Traffic Traction Protector can identify traffic based on the L2-L4 layer header identifier, such as VLAN tag,source / destination MAC address, source IP address, IP packet type, transport layer protocol port, protocol header key tag, and so on. A variety of matching conditions flexible combination can be defined flexibly to define the specific traffic types that are of interest to a particular security device and can be widely used for the deployment of special security auditing devices (RDP, SSH, database auditing, etc.).

3. Bypass Switch Bypass TAP Technical Characteristics

LinkSafeSwitch Technology

NetTAP® Network TAP Bypass Switch Policy Traction Protector can be customized heartbeat interval and the maximum number of retries, to detect and determine the fault status of the serial security device in order to achieve the protection of the fast bypass switch. At the same time, NetTAP® policy traffic traction protector unique link switching technology can ensure that the implementation of the bypass switch when the main link state without any impact. This technique will ensure that the bypass switch is more secure and will not cause the Layer 2 / Layer 3 topology protocol of the protected link to recalculate and converge.

4. Bypass Switch Bypass TAP Technical Specifications

NT-MBYP-CHS Bypass Switch.pdf